Field of the Invention
The present invention relates to a method and system for verifying an access request, and is particularly, but not exclusively suitable for verifying a request for access to data, services or assets.
Description of the Related Technology
The demand for access to confidential or user-specific data (or assets or services) is increasing. For example, providing access to a bank account and allowing the transfer of money from that account should be restricted to authorized users such as an account holder. Typically users are authenticated when requesting access to data by means of credentials that identify the person requesting access to the data. Remote access of data presents particular problems because the person requesting data, assets or services is typically in a different physical location to that of the party responding to the request. As a result it is very difficult for the party servicing the request to know whether the entity making the request is a) who they claim to be, b) entitled to use the device from where the request originates and c) is in possession of the device from where the request originates.
Typically, when an account is set up between a person and a party such as a data provider, the person will establish the aforementioned credentials for use by the data provider in identifying and authenticating the person for future requests. Such credentials may include information that uniquely identifies the parson (e.g. personally identifiable information (PII)) and a secret (e.g. a password) for use in verifying the identity of the person. It is now also common that the data provider will require the person to register themselves as the owner of a device used to access the data. The registered association between the device and the owner of the device can be used by the data provider as an additional validation factor. For example, in the case that a data provider receives a request for access to an account on behalf of a particular person from a particular device that is not the device registered for the person, the data provider may determine to trust that the request was made by the person registered for the account.
It can be relatively easy for a person wishing to access data from a data provider on behalf of another person who has an account with that data provider to obtain his user credentials (i.e. PII, User ID and password) by purchasing them from criminal shadow online markets and thereafter fraudulently access the other person's data. Additionally, it is possible to remotely access and control devices, and thereby request data on behalf of the registered owner of those devices. Often it is not possible to determine whether the request was made by a user who is in physical possession of the device or whether the request was made remotely by a user using another device to remotely control the device from which the request is made.
One-time passwords (OTP) are commonly used to alleviate these issues: an authentication server uniquely assigns an OTP generation key to the registered owner of a device, the OTP generation key being for use in generating and validating OTPs. An authentication server typically holds hundreds or thousands of OTP generation keys, each having been uniquely assigned to, or registered in respect of, a different person. The authentication server configures an OTP token in the possession of the registered owner with his assigned OTP generation key. These OTP tokens may, for example, use the OTP generation key to generate a different password each time a new password is requested by the registered user or as another example, may use the OTP generation key to generate new passwords at regular time intervals. The OTP token may additionally use an indication of the current time to generate an OTP, to prevent the OTP being stored and replayed at a later time.
In order to access user-restricted data via a device, a user provides the OTP generated by the OTP token to the data provider along with the credentials that uniquely identify the owner of the device. Typically, the data provider will then identify the owner of the device and pass on the received OTP to the authentication server. The authentication server will look up the OTP generation key associated with the identified person and will use the key, and if required the current time, to determine whether the received OTP corresponds to the OTP that would have been generated by the OTP token held by the owner of the device at the current time, or at least within a predetermined period of the current time. The authentication server will then indicate to the data provider whether the received OTP is valid. If the correct OTP was sent to the data provider, then it can be determined that the user of the device is in possession of the OTP token. However, authentication servers are vulnerable to compromise thereby facilitating the unauthorized distribution to other entities and enabling anyone with (illegitimate) access to a distributed OTP generation key to access data on behalf of the person associated with that key.